CVE-2023-38864

CriticalCVSS 9.8

Published: 15/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.08%

61th percentile - higher than 61% of all known CVEs

Summary

Version 2.7.2 of the COMFAST CF-XR11 device contains a vulnerability that allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C function in the bin/webmgnt file.

Risk Assessment

Exploitation of this vulnerability could lead to device takeover, posing a serious security threat to the organization's network.

Recommendation

It is recommended to update the device to the latest firmware version to mitigate this vulnerability.

Original NVD description (English source)

An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C function at bin/webmgnt.